Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

rclone — Vulnerabilities & Security Advisories 32

All 32 CVE vulnerabilities found in rclone, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities affecting rclone, an open-source command-line program for managing cloud storage. It collects known software flaws and security weaknesses documented in public advisories for this specific product. The dataset covers vulnerabilities disclosed over the recent years, providing a historical record of security issues identified in the codebase. Readers can use this resource to track the vendor's security advisories, understand the prevalence of specific weakness classes, or look up the complete vulnerability history of the product. The collection includes various types of software defects, ranging from logic errors to potential denial of service conditions, helping users assess the security posture of rclone. By centralizing this information, the page serves as a reference for security professionals and developers who need to monitor updates and patches. This aggregation facilitates a clearer understanding of the types of risks associated with the tool without requiring users to search multiple disparate databases individually. The focus remains strictly on documented security issues that have been publicly reported and assigned identifiers. This data is intended for informational purposes to aid in risk assessment and compliance planning. Users should note that the presence of an entry does not guarantee active exploitability in all deployed versions, as patching status varies by release. The list is updated as new vulnerabilities are confirmed and published by the maintainers or security researchers.

Vendor: rclone

CVE ID Title CVSS Severity Published
CVE-2026-93986 rclone before 1.75.1 Path Traversal via Directory Listing Names CWE-22 3.1 Low 2026-09-19
CVE-2026-93987 rclone serve docker Path Traversal via Volume Name CWE-73 3.4 Low 2026-09-19
CVE-2026-88046 rclone: source object names can escape the configured root on upload CWE-22 5.3 Medium 2026-09-10
CVE-2026-88045 rclone: S3 multipart declared-length memory exhaustion CWE-789 7.5 High 2026-09-10
CVE-2026-88044 rclone: RC per-server auth-proxy bypass CWE-863 9.1 Critical 2026-09-10
CVE-2026-88018 rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass CWE-287 9.8 Critical 2026-09-10
CVE-2026-88017 rclone: FTP cross-session auth-proxy backend confusion CWE-488 7.3 High 2026-09-10
CVE-2026-88016 rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination CWE-59 7.1 High 2026-09-10
CVE-2026-88015 rclone local: crafted Range request against a translated symlink panics (DoS) CWE-190 5.3 Medium 2026-09-10
CVE-2026-88014 rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace CWE-22 6.3 Medium 2026-09-10
CVE-2026-88013 rclone: http backend forwards custom/auth headers to a different host on redirect CWE-200 3.7 Low 2026-09-10
CVE-2026-79783 rclone before 1.74.4 Privilege Escalation via setuid Metadata CWE-732 3.6 Low 2026-08-25
CVE-2026-79782 rclone before 1.74.4 Security Token Disclosure via HTTPS to HTTP Redirect CWE-319 3.1 Low 2026-08-25
CVE-2026-79780 rclone before v1.75.0 Credential Exposure via S3 Redirect CWE-200 5.3 Medium 2026-08-25
CVE-2026-79781 rclone serve s3 Path Traversal via dot-dot object keys CWE-22 6.5 Medium 2026-08-25
CVE-2026-79779 rclone before v1.75.0 WebDAV Credential Exposure via HTTPS-to-HTTP Redirect CWE-319 5.3 Medium 2026-08-25
CVE-2026-79777 rclone before v1.75.0 Information Disclosure via RC API CWE-209 2.7 Low 2026-08-25
CVE-2026-79778 rclone before v1.75.0 Denial of Service via TUS nil-response panic CWE-248 5.3 Medium 2026-08-25
CVE-2026-79776 rclone before 1.75.0 Authentication Bypass via pprof CWE-200 5.3 Medium 2026-08-25
CVE-2026-79775 rclone Archive Backend SquashFS Parser Denial of Service CWE-129 6.5 Medium 2026-08-25
CVE-2026-71313 rclone: Local Encoding Path Traversal CWE-22 6.9 Medium 2026-08-05
CVE-2026-71312 rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution CWE-78 8.0 High 2026-08-05
CVE-2026-71311 rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines CWE-93 6.4 Medium 2026-08-05
CVE-2026-71310 rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory CWE-400 5.9 Medium 2026-08-05
CVE-2026-71309 rclone: Incomplete path validation allows backend root escape in serve restic CWE-22 8.6 High 2026-08-05
CVE-2026-59733 rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories CWE-22 8.8 High 2026-07-14
CVE-2026-54572 rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote CWE-59 7.5 High 2026-07-14
CVE-2026-59732 rclone archive extract allows S3 destination prefix escape via crafted archive paths CWE-22 5.0 Medium 2026-07-14
CVE-2026-49980 Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix CWE-306 9.8 Critical 2026-06-24
CVE-2026-41179 RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution CWE-78 9.8 - 2026-04-23

All 32 known CVE vulnerabilities affecting rclone with full Chinese analysis, references, and POCs where available.